1<?php
 2error_reporting(0);
 3$file = base64_decode(isset($_GET['filename']) ? $_GET['filename'] : "");
 4$line = isset($_GET['line']) ? intval($_GET['line']) : 0;
 5if ($file == '') header("location:index.php?line=&filename=a2V5cy50eHQ=");
 6$file_list = array(
 7    '0' => 'keys.txt',
 8    '1' => 'index.php',
 9);
10
11if (isset($_COOKIE['margin']) && $_COOKIE['margin'] == 'margin') {
12    $file_list[2] = 'keys.php';
13}
14
15if (in_array($file, $file_list)) {
16    $fa = file($file);
17    echo $fa[$line];
18}

 1if(!$_GET['id'])
 2{
 3	header('Location: hello.php?id=1');
 4	exit();
 5}
 6$id=$_GET['id'];
 7$a=$_GET['a'];
 8$b=$_GET['b'];
 9if(stripos($a,'.'))
10{
11	echo 'no no no no no no no';
12	return ;
13}
14$data = @file_get_contents($a,'r');
15if($data=="bugku is a nice plateform!" and $id==0 and strlen($b)>5 and eregi("111".substr($b,0,1),"1114") and substr($b,0,1)!=4)
16{
17	$flag = "flag{***********}"
18}
19else
20{
21	print "never never never give up !!!";
22}

 1<?php
 2error_reporting(0);
 3$zero = $_REQUEST["zero"];
 4$first = $_REQUEST["first"];
 5$second = $zero . $first;
 6if (preg_match_all("/Yeedo|wants|a|girl|friend|or|a|flag/i", $second)) {
 7    $key = $second;
 8    if (preg_match("/\.\.|flag/", $key)) {
 9        die("Noooood hacker!");
10    } else {
11        $third = $first;
12        if (preg_match("/\\|\056\160\150\x70/i", $third)) {
13            $end = substr($third, 5);
14            highlight_file(base64_decode($zero) . $end); //maybe flag in flag.php
15        }
16    }
17} else {
18    highlight_file(__FILE__);
19}

 1<?php
 2highlight_file(__FILE__);
 3error_reporting(0);
 4
 5class Happy{
 6    private $cmd;
 7    private $content;
 8
 9    public function __construct($cmd, $content)
10    {
11        $this->cmd = $cmd;
12        $this->content = $content;
13    }
14
15    public function __call($name, $arguments)
16    {
17        call_user_func($this->cmd, $this->content);
18    }
19
20    public function __wakeup()
21    {
22        die("Wishes can be fulfilled");
23    }
24}
25
26class Nevv{
27    private $happiness;
28
29    public function __invoke()
30    {
31        return $this->happiness->check();
32    }
33
34}
35
36class Rabbit{
37    private $aspiration;
38    public function __set($name,$val){
39        return $this->aspiration->family;
40    }
41}
42
43class Year{
44    public $key;
45    public $rabbit;
46
47    public function __construct($key)
48    {
49        $this->key = $key;
50    }
51
52    public function firecrackers()
53    {
54        return $this->rabbit->wish = "allkill QAQ";
55    }
56
57    public function __get($name)
58    {
59        $name = $this->rabbit;
60        $name();
61    }
62
63    public function __destruct()
64    {
65        if ($this->key == "happy new year") {
66            $this->firecrackers();
67        }else{
68            print("Welcome 2023!!!!!");
69        }
70    }
71}
72
73if (isset($_GET['pop'])) {
74    $a = unserialize($_GET['pop']);
75}else {
76    echo "过新年啊~过个吉祥年~";
77}
78?>

 1<?php
 2error_reporting(0);
 3
 4class Happy{
 5    private $cmd;
 6    private $content;
 7
 8    public function __construct()
 9    {
10        $this->cmd = "system";
11        $this->content = "cat /flag";
12    }
13}
14
15class Nevv{
16    private $happiness;
17
18    public function __construct($obj)
19    {
20        $this->happiness=$obj;
21    }
22}
23
24class Rabbit{
25    private $aspiration;
26    public function __construct($obj)
27    {
28        $this->aspiration=$obj;
29    }
30}
31
32class Year{
33    public $key;
34    public $rabbit;
35
36    public function __construct($obj)
37    {
38        $this->rabbit = $obj;
39        $this->key="happy new year";
40    }
41}
42
43$h=new Happy();
44$n=new Nevv($h);
45$y=new Year($n);
46$r=new Rabbit($y);
47
48$y2=new Year($r);
49echo urlencode(serialize($y2));
50
51?>

 1<?php
 2function encrypt($data,$key)
 3{
 4    $key = md5('ISCC');
 5    $x = 0;
 6    $len = strlen($data);
 7    $klen = strlen($key);
 8    for ($i=0; $i < $len; $i++) { 
 9        if ($x == $klen)
10        {
11            $x = 0;
12        }
13        $char .= $key[$x];
14        $x+=1;
15    }
16    for ($i=0; $i < $len; $i++) {
17        $str .= chr((ord($data[$i]) + ord($char[$i])) % 128);
18    }
19    return base64_encode($str);
20}
21?>

 1<?php
 2function encrypt($data, $key)
 3{
 4    $key = md5('ISCC'); //729623334f0aa2784a1599fd374c120d
 5    $x = 0;
 6    $len = strlen($data); //$data长度
 7    $klen = strlen($key); //32
 8    $char = '';
 9    //key的前$len位连起来
10    for ($i = 0; $i < $len; $i++) {
11        //key用完了，就从头开始
12        if ($x == $klen) {
13            $x = 0;
14        }
15        $char .= $key[$x];
16        $x += 1;
17    }
18    // data的每一位ASCII和$char的加起来，模128，转字符
19    // 前$len位
20    for ($i = 0; $i < $len; $i++) {
21        $str .= chr((ord($data[$i]) + ord($char[$i])) % 128);
22    }
23    return base64_encode($str);
24}
25//如果$data长度为32,那么$char=$key
26
27function decrypt($C)
28{
29    $D = base64_decode($C);
30    $char = md5('ISCC');
31    $len = strlen($D);
32    $plain = '';
33    $x = 0;
34    for ($i = 0; $i < $len; $i++) {
35        if ($x == 32) {
36            $x = 0;
37        }
38        $s = ord($D[$i]); //把每个字符转ASCII
39        $plain .= chr(($s - ord($char[$x]) + 128) % 128);
40        $x += 1;
41    }
42    echo $plain;
43}
44
45decrypt("fR4aHWwuFCYYVydFRxMqHhhCKBseH1dbFygrRxIWJ1UYFhotFjA=");

 1function decrypt($C)
 2{
 3    $D = base64_decode($C);
 4    $key = md5('ISCC'); // 729623334f0aa2784a1599fd374c120d
 5    $klen = strlen($key); // 32
 6    $len = strlen($D);    // 密文长度
 7    $plain = '';
 8
 9    for ($i = 0; $i < $len; $i++) {
10        // 1. 实现密钥循环逻辑
11        $keyChar = $key[$i % $klen]; 
12        
13        // 2. 获取当前密文字符的 ASCII 值
14        $s = ord($D[$i]);
15        
16        // 3. 还原算法：(密文 - 密钥 + 128) % 128
17        // 这样可以确保结果永远落在 0-127 的有效 ASCII 范围内
18        $plain .= chr(($s - ord($keyChar) + 128) % 128);
19    }
20
21    echo "解密结果: " . $plain;
22}
23
24decrypt("fR4aHWwuFCYYVydFRxMqHhhCKBseH1dbFygrRxIWJ1UYFhotFjA=");

 1<?php
 2// php版本:5.4.44
 3header("Content-type: text/html; charset=utf-8");
 4highlight_file(__FILE__);
 5
 6class evil{
 7    public $hint;
 8
 9    public function __construct($hint){
10        $this->hint = $hint;
11    }
12
13    public function __destruct(){
14    if($this->hint==="hint.php")
15            @$this->hint = base64_encode(file_get_contents($this->hint)); 
16        var_dump($this->hint);
17    }
18
19    function __wakeup() { 
20        if ($this->hint != "╭(●｀∀´●)╯") { 
21            //There's a hint in ./hint.php
22            $this->hint = "╰(●’◡’●)╮"; 
23        } 
24    }
25}
26
27class User
28{
29    public $username;
30    public $password;
31
32    public function __construct($username, $password){
33        $this->username = $username;
34        $this->password = $password;
35    }
36
37}
38
39function write($data){
40    global $tmp;
41    $data = str_replace(chr(0).'*'.chr(0), '\0\0\0', $data);
42    $tmp = $data;
43}
44
45function read(){
46    global $tmp;
47    $data = $tmp;
48    $r = str_replace('\0\0\0', chr(0).'*'.chr(0), $data);
49    return $r;
50}
51
52$tmp = "test";
53$username = $_POST['username'];
54$password = $_POST['password'];
55
56$a = serialize(new User($username, $password));
57if(preg_match('/flag/is',$a))
58    die("NoNoNo!");
59
60unserialize(read(write($a)));

 1const Admin = {
 2    "password":process.env.password?process.env.password:"password"
 3}
 4
 5router.post("/getflag", function (req, res, next) {
 6    if (req.body.password === undefined || req.body.password === req.session.challenger.password){
 7        res.send("登录失败");
 8    }else{
 9        if(req.session.challenger.age > 79){
10            res.send("糟老头子坏滴很");
11        }
12        let key = req.body.key.toString();
13        let password = req.body.password.toString();
14        if(Admin[key] === password){
15            res.send(process.env.flag ? process.env.flag : "flag{test}");
16        }else {
17            res.send("密码错误，请使用管理员用户名登录.");
18        }
19    }
20
21});

 1include('./libs/Smarty.class.php');
 2echo "pass a parameter and maybe the flag file's filename is random :>";
 3$smarty = new Smarty();
 4if($_GET){
 5    highlight_file('index.php');
 6    foreach ($_GET AS $key => $value)
 7    {
 8        print $key."\n";
 9        if(preg_match("/flag|\/flag/i", $value)){
10            
11            $smarty->display('./template.html');
12
13
14        }elseif(preg_match("/system|readfile|gz|exec|eval|cat|assert|file|fgets/i", $value)){
15
16
17            $smarty->display('./template.html');            
18            
19        }else{
20            $smarty->display("eval:".$value);
21        }
22        
23    }
24}
25?> 

 1#!/usr/bin/python3 
 2# -*- coding: UTF-8 -*- 
 3""" 
 4@ Author: HeliantHuS 
 5@ Codes are far away from bugs with the animal protecting 
 6@ Time: 2021-08-05 
 7@ FileName: main.py 
 8""" 
 9import pickle 
10import base64 
11from flask import Flask, request 
12app = Flask(__name__) 
13@app.route("/", methods=["GET"]) 
14def index(): 
15    return """
16Not Found
17The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.
18
19""", 666, [("TIPS", "/source")] 
20
21@app.route("/source", methods=["GET"]) 
22def source(): 
23    with open(__file__, "r") as fp: 
24        return fp.read() 
25@app.route("/flag", methods=["PUT"]) 
26def get_flag(): 
27    try: 
28        data = request.json 
29        if data: 
30            return pickle.loads(base64.b64decode(data["payload"])) 
31        return "MISSED" 
32    except: 
33        return "OH NO!!!" 
34if __name__ == '__main__': 
35    app.run(host="0.0.0.0", port=80)

 1#!/usr/bin/env python3
 2from flask import Flask, request, render_template, render_template_string, redirect
 3import subprocess
 4import urllib
 5
 6app = Flask(__name__)
 7
 8def blacklist(inp):
 9    blacklist = ['mro','url','join','attr','dict','()','init','import','os','system','lipsum','current_app','globals','subclasses','|','getitem','popen','read','ls','flag.txt','cycler','[]','0','1','2','3','4','5','6','7','8','9','=','+',':','update','config','self','class','%','#']
10    for b in blacklist:
11        if b in inp:
12            return "Blacklisted word!"
13    if len(inp) <= 70:
14        return inp
15    if len(inp) > 70:
16        return "Input too long!"
17
18@app.route('/')
19def main():
20    return redirect('/generate')
21
22@app.route('/generate',methods=['GET','POST'])
23def generate_certificate():
24    if request.method == 'GET':
25        return render_template('generate_certificate.html')
26    elif request.method == 'POST':
27        name = blacklist(request.values['name'])
28        teamname = request.values['team_name']
29        return render_template_string(f'<p>Haha! No certificate for {name}</p>')
30
31if __name__ == '__main__':
32    app.run(host='0.0.0.0', port=80)

  1<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
  2<html>
  3<head>
  4<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
  5<title>Login Form</title>
  6<link href="static/css/style.css" rel="stylesheet" type="text/css" />
  7<script type="text/javascript" src="static/js/jquery.min.js"></script>
  8<script type="text/javascript">
  9$(document).ready(function() {
 10	$(".username").focus(function() {
 11		$(".user-icon").css("left","-48px");
 12	});
 13	$(".username").blur(function() {
 14		$(".user-icon").css("left","0px");
 15	});
 16
 17	$(".password").focus(function() {
 18		$(".pass-icon").css("left","-48px");
 19	});
 20	$(".password").blur(function() {
 21		$(".pass-icon").css("left","0px");
 22	});
 23});
 24</script>
 25</head>
 26
 27<?php
 28define("SECRET_KEY", file_get_contents('/root/key'));
 29define("METHOD", "aes-128-cbc");
 30session_start();
 31
 32function get_random_iv(){
 33    $random_iv='';
 34    for($i=0;$i<16;$i++){
 35        $random_iv.=chr(rand(1,255));
 36    }
 37    return $random_iv;
 38}
 39
 40function login($info){
 41    $iv = get_random_iv();
 42    $plain = serialize($info);
 43    $cipher = openssl_encrypt($plain, METHOD, SECRET_KEY, OPENSSL_RAW_DATA, $iv);
 44    $_SESSION['username'] = $info['username'];
 45    setcookie("iv", base64_encode($iv));
 46    setcookie("cipher", base64_encode($cipher));
 47}
 48
 49function check_login(){
 50    if(isset($_COOKIE['cipher']) && isset($_COOKIE['iv'])){
 51        $cipher = base64_decode($_COOKIE['cipher']);
 52        $iv = base64_decode($_COOKIE["iv"]);
 53        if($plain = openssl_decrypt($cipher, METHOD, SECRET_KEY, OPENSSL_RAW_DATA, $iv)){
 54            $info = unserialize($plain) or die("<p>base64_decode('".base64_encode($plain)."') can't unserialize</p>");
 55            $_SESSION['username'] = $info['username'];
 56        }else{
 57            die("ERROR!");
 58        }
 59    }
 60}
 61
 62function show_homepage(){
 63    if ($_SESSION["username"]==='admin'){
 64        echo '<p>Hello admin</p>';
 65        echo '<p>Flag is $flag</p>';
 66    }else{
 67        echo '<p>hello '.$_SESSION['username'].'</p>';
 68        echo '<p>Only admin can see flag</p>';
 69    }
 70    echo '<p><a href="loginout.php">Log out</a></p>';
 71}
 72
 73if(isset($_POST['username']) && isset($_POST['password'])){
 74    $username = (string)$_POST['username'];
 75    $password = (string)$_POST['password'];
 76    if($username === 'admin'){
 77        exit('<p>admin are not allowed to login</p>');
 78    }else{
 79        $info = array('username'=>$username,'password'=>$password);
 80        login($info);
 81        show_homepage();
 82    }
 83}else{
 84    if(isset($_SESSION["username"])){
 85        check_login();
 86        show_homepage();
 87    }else{
 88        echo '<body class="login-body">
 89                <div id="wrapper">
 90                    <div class="user-icon"></div>
 91                    <div class="pass-icon"></div>
 92                    <form name="login-form" class="login-form" action="" method="post">
 93                        <div class="header">
 94                        <h1>Login Form</h1>
 95                        <span>Fill out the form below to login to my super awesome imaginary control panel.</span>
 96                        </div>
 97                        <div class="content">
 98                        <input name="username" type="text" class="input username" value="Username" onfocus="this.value=\'\'" />
 99                        <input name="password" type="password" class="input password" value="Password" onfocus="this.value=\'\'" />
100                        </div>
101                        <div class="footer">
102                        <input type="submit" name="submit" value="Login" class="button" />
103                        </div>
104                    </form>
105                </div>
106            </body>';
107    }
108}
109?>
110</html>